Junglewise Threat Intelligence

CVE-2026-14500: sayantandas20 Bulk Order Update for WooCommerce arbitrary file read

CVE-2026-14500 · Severity: medium · CVSS 5.3 · Published 2026-07-08

Executive brief

The Bulk Order Update for WooCommerce plugin for WordPress, which helps store owners manage large numbers of orders, contains a security flaw that allows unauthorized users to read sensitive files from the web server. By exploiting this vulnerability, an attacker could potentially access system configuration files or verify the existence of specific files on the server. This could lead to the exposure of sensitive information that might be used to launch further attacks against the website.

Technical details

The vulnerability exists in the bouw_fetch_csv_data() AJAX handler, which is registered via the wp_ajax_nopriv_ hook without capability or nonce checks. The handler accepts an attacker-supplied 'csv_url' POST parameter and passes it to fopen() and fgetcsv() after insufficient filtering by esc_url_raw() and validate_file(). Because esc_url_raw() does not strip absolute filesystem paths and validate_file() only checks for '..' traversal patterns, an unauthenticated attacker can provide a local file path (e.g., /etc/passwd). The plugin then reflects the first parsed line of the target file in the JSON response, enabling arbitrary file read and file-existence oracles.

Affected products

  • sayantandas20 Bulk Order Update for WooCommerce up to, and including, 1.6

Timeline

  • 2026-07-08: advisory: NVD publication date

References